An unbounded index calculation in frp's optional SSH Tunnel Gateway causes a 4-byte integer overflow when parsing an SSH exec channel request if the payload length equals 0xFFFFFFFF. The overflow results in a wrap to 3, bypassing the bounds check and triggering a panic in TunnelServer.handleNewChannel. This crash terminates the frps process, effectively dropping every active tunnel. The vulnerability can be exploited by sending a five-byte request before authentication is verified, allowing an unauthenticated attacker to cause the denial of service. The weakness originates from improper integer handling and bounds checking (CWE-129, CWE-190).

The issue affects the frp reverse proxy distributed by fatedier. All releases from 0.53.0 up to and including 0.70.1 contain the vulnerable SSH Tunnel Gateway logic. Versions before 0.53.0 or after 0.70.1 are not affected. Systems running frps without an authorized-keys configuration and that enable the default NoClientAuth option for the SSH gate are at risk.

The CVSS base score is 8.7, indicating a high severity. EPSS data is not provided, and the vulnerability is not listed in CISA's KEV catalog. The attack can be performed remotely without authentication, exploiting the unvalidated length field in an SSH exec channel request. The exploit requires only network connectivity to the frps SSH port, making it straightforward to execute against exposed deployments. Once exploited, the frps service is terminated, disrupting all active tunnels until the process is restarted.